add appId to verifyToken return value